Medium — SOA-C02 Practice Quiz

Question 1

A SysOps administrator must enable HTTPS for a public-facing web application served by an Application Load Balancer (ALB). Security requires that the TLS certificate be automatically renewed to avoid expiration-related outages, and that no certificate private keys are ever stored on or accessible by the EC2 instances. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Request a public certificate from AWS Certificate Manager (ACM) in the same Region as the ALB and associate it with an HTTPS listener on the ALB.

Answer

Purchase a certificate from a third-party CA, install it on each EC2 instance, and configure the ALB to pass TLS traffic through to the instances.

Answer

Import a self-signed certificate into ACM and attach it to the ALB HTTPS listener, then set a calendar reminder to reimport before expiry.

Answer

Request a public certificate from ACM in us-east-1 and reference it from the ALB regardless of the ALB's Region to enable automatic renewal.

Question 2

A SysOps administrator manages a public-facing website behind an Application Load Balancer using an ACM certificate that was issued with DNS validation. The certificate is approaching its expiration date, and CloudWatch shows the certificate is NOT being automatically renewed. The domain's DNS is hosted in Amazon Route 53 in the same account. What is the MOST likely cause of the failed automatic renewal?

Accepted Answer

The CNAME record that ACM created for DNS validation was deleted or modified in the Route 53 hosted zone.

Answer

ACM certificates must be manually renewed every 13 months; automatic renewal is not supported.

Answer

The certificate must be reissued with email validation to support automatic renewal.

Answer

The ACM certificate is not associated with a CloudFront distribution, which is required for renewal.

Question 3

A SysOps administrator manages an Application Load Balancer (ALB) that distributes traffic to an Auto Scaling group spanning three Availability Zones. After a recent scaling event, the group has 6 instances in us-east-1a, 2 in us-east-1b, and 2 in us-east-1c. Users report that the instances in us-east-1b and us-east-1c are receiving noticeably higher CPU utilization than those in us-east-1a. What is the most likely cause of this uneven load?

Accepted Answer

Cross-zone load balancing is disabled, so each AZ receives an equal share of traffic regardless of instance count

Answer

The ALB health checks are failing for instances in us-east-1a, removing them from rotation

Answer

Target tracking scaling is misconfigured and only launching instances in us-east-1a

Answer

Connection draining (deregistration delay) is set too high on the target group

Question 4

A SysOps administrator manages an EC2 Auto Scaling group behind an Application Load Balancer. The application takes about 4 minutes to fully initialize and pass the ALB target group health checks after an instance launches. The Auto Scaling group is configured to use ELB health checks. Administrators notice that newly launched instances are being terminated and replaced repeatedly, causing a launch loop that never stabilizes. What is the MOST likely cause and appropriate fix?

Accepted Answer

The Auto Scaling group health check grace period is set too low; increase it to accommodate the application's 4-minute initialization time.

Answer

The ALB target group deregistration delay is too high; reduce it so unhealthy instances are removed faster.

Answer

The scaling policy cooldown period is too short; increase the cooldown to prevent repeated launches.

Answer

The launch template uses an incorrect AMI; rebuild the AMI to reduce boot time.

Question 5

A SysOps administrator manages a stateful web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. Each instance maintains long-running upload sessions. During scale-in events, users report that in-progress uploads are abruptly terminated before completing. The administrator needs to ensure that instances complete active sessions before being terminated. Which approach BEST solves this problem?

Accepted Answer

Add an EC2 instance-terminating lifecycle hook to the Auto Scaling group that pauses termination and use a script to signal CONTINUE once active sessions drain.

Answer

Increase the health check grace period on the Auto Scaling group so instances have more time before termination.

Answer

Configure a target tracking scaling policy with a longer scale-in cooldown period to delay terminations.

Answer

Enable cross-zone load balancing on the Application Load Balancer to distribute connections more evenly.

Question 6

A company runs a stateless web application on an EC2 Auto Scaling group spanning three Availability Zones behind an Application Load Balancer. After a large scale-in event followed by manual instance terminations during troubleshooting, a SysOps administrator notices that 8 of the 10 running instances are concentrated in a single Availability Zone. The team is concerned that an AZ failure could remove most of the fleet's capacity. Which action will BEST ensure the Auto Scaling group maintains a balanced distribution of instances across the Availability Zones going forward?

Accepted Answer

Rely on the Auto Scaling group's default AZ rebalancing, which automatically launches instances in under-provisioned AZs and terminates instances in over-provisioned AZs to restore balance.

Answer

Configure a target tracking scaling policy based on average CPU utilization so that new instances are spread evenly across AZs during scale-out.

Answer

Manually terminate the extra instances in the crowded AZ and launch replacements in the other AZs each time an imbalance is detected.

Answer

Enable cross-zone load balancing on the Application Load Balancer so traffic is distributed evenly regardless of instance placement per AZ.

Question 7

An e-commerce company runs a web application on an EC2 Auto Scaling group behind an Application Load Balancer. Every business day, traffic spikes sharply at exactly 9:00 AM when a marketing email is sent, and the surge lasts about two hours. During this window, the application currently responds slowly because target tracking scaling reacts only after CloudWatch metrics breach thresholds, leaving a few minutes of under-provisioning. The company wants capacity available the moment the spike begins. What is the MOST effective way to address this?

Accepted Answer

Create a scheduled scaling action that increases the desired and minimum capacity shortly before 9:00 AM, and another to reduce it after the peak

Answer

Lower the target tracking value so the group scales out more aggressively throughout the day

Answer

Replace target tracking with step scaling using smaller CloudWatch evaluation periods

Answer

Enable detailed monitoring on the instances to shorten the metric collection interval to one minute

Question 8

A SysOps administrator manages an EC2 Auto Scaling group behind an Application Load Balancer for a web application. The application experiences unpredictable, large traffic spikes where CPU utilization can jump from 40% to 90% within a minute. The current target tracking policy targeting 50% average CPU adds instances too slowly during these sudden bursts, causing brief periods of degraded performance. The administrator needs the scaling response to be more aggressive as the breach magnitude increases. Which scaling configuration change BEST addresses this requirement?

Accepted Answer

Replace the target tracking policy with a step scaling policy that adds progressively more instances as CPU exceeds higher thresholds.

Answer

Lower the target tracking policy's target value from 50% to 30% CPU utilization.

Answer

Add a scheduled scaling action to increase the desired capacity every hour.

Answer

Enable predictive scaling using machine learning forecasts of daily traffic patterns.

Question 9

A SysOps administrator manages a web application behind an Application Load Balancer with an EC2 Auto Scaling group. Traffic patterns are unpredictable, and CPU utilization stays low even during peak periods because the workload is I/O bound. During traffic surges, users experience slow responses even though the CPU-based target tracking policy never triggers scale-out. The administrator needs the group to scale based on how much traffic each instance actually handles. Which scaling configuration BEST addresses this?

Accepted Answer

Create a target tracking scaling policy using the ALBRequestCountPerTarget predefined metric with a target value for requests per instance.

Answer

Create a step scaling policy triggered by an alarm on the ALB's total RequestCount metric.

Answer

Lower the target value on the existing CPU utilization target tracking policy so it scales out sooner.

Answer

Enable detailed monitoring on the instances so CPU metrics are published every minute.

Question 10

A SysOps administrator manages a production application that stores data in an Amazon RDS for PostgreSQL Multi-AZ instance and several Amazon EBS volumes in the us-east-1 Region. The compliance team requires that all backups be retained for 90 days and that a copy of every backup exist in the us-west-2 Region to meet disaster recovery objectives. The solution must be centrally managed and automated with minimal operational overhead. Which approach BEST meets these requirements?

Accepted Answer

Create an AWS Backup plan with a backup rule that assigns a 90-day retention period and configure a copy action in the rule to replicate recovery points to a backup vault in us-west-2.

Answer

Enable automated RDS snapshots and EBS Data Lifecycle Manager policies in us-east-1, then write a Lambda function scheduled with EventBridge to copy each snapshot to us-west-2.

Answer

Configure an AWS Backup plan in us-east-1 with 90-day retention, then manually copy the latest recovery points to us-west-2 each month using the AWS CLI.

Answer

Turn on cross-Region read replicas for the RDS instance and enable EBS multi-attach so the volumes are available in us-west-2 for recovery.

Question 11

A SysOps administrator manages backups for a fleet of EC2 instances and RDS databases using AWS Backup. During a recent audit, the compliance team asked for proof that the backups are actually recoverable and meet the documented 4-hour RTO. The administrator wants an automated, repeatable way to validate that recovery points can be successfully restored on a recurring schedule, without manually launching restores each time. Which approach should the administrator implement?

Accepted Answer

Configure AWS Backup restore testing plans that automatically restore selected recovery points on a schedule and validate them

Answer

Enable AWS Backup Vault Lock in compliance mode to guarantee that all recovery points are restorable

Answer

Create an EventBridge rule that emails the team whenever a backup job completes successfully

Answer

Increase the backup frequency in the backup plan to hourly to reduce the RPO and prove recoverability

Question 12

A financial services company must ensure that its EBS and RDS backups cannot be deleted or have their retention periods shortened by anyone—including administrators with full AWS Backup permissions—for a mandatory 7-year compliance retention. A SysOps administrator has already created an AWS Backup vault and a backup plan that copies backups into it. Which action will enforce this immutable retention requirement?

Accepted Answer

Apply AWS Backup Vault Lock in compliance mode with a minimum and maximum retention period, and let the cooling-off period elapse.

Answer

Attach an IAM policy to all administrators that denies the backup:DeleteRecoveryPoint action.

Answer

Enable AWS Backup Vault Lock in governance mode and set the retention to 7 years.

Answer

Enable EBS snapshot and RDS automated backup deletion protection in the respective service consoles.

Question 13

A SysOps administrator manages a development AWS account where engineers frequently leave EC2 instances running overnight. Management wants an automated control that not only alerts the team when monthly EC2 spend exceeds $2,000 but also automatically applies a restrictive IAM policy to prevent launching additional instances once the threshold is crossed. Which solution meets these requirements with the least custom development?

Accepted Answer

Create an AWS Budget with a cost threshold and configure a Budget action that attaches a restrictive IAM policy when the threshold is exceeded.

Answer

Enable AWS Cost Explorer rightsizing recommendations and schedule a Lambda function to terminate idle instances nightly.

Answer

Configure a CloudWatch billing alarm that publishes to an SNS topic subscribed by the engineering team's email.

Answer

Set up a Cost and Usage Report delivered to S3 and use Athena to query daily EC2 spend for manual review.

Question 14

A SysOps administrator is authoring a CloudFormation template that provisions EC2 instances running a web application. The instances must install packages, write configuration files, and start services in a specific, ordered sequence during launch. The administrator also wants the CloudFormation stack to wait until the bootstrap process completes successfully before marking the resource CREATE_COMPLETE, and to report a failure if the configuration does not finish. Which approach best meets these requirements?

Accepted Answer

Define the bootstrap steps in the AWS::CloudFormation::Init metadata, invoke cfn-init in the instance UserData, and use cfn-signal with a CreationPolicy on the instance to report success or failure.

Answer

Place all install and configuration commands as a shell script in UserData, and rely on the EC2 instance reaching the 'running' state to signal completion to CloudFormation.

Answer

Use a DependsOn attribute on the EC2 instance referencing a WaitConditionHandle so CloudFormation automatically pauses until packages are installed.

Answer

Configure the bootstrap steps in an SSM State Manager association and set a DeletionPolicy of Retain on the instance to ensure configuration completes.

Question 15

A SysOps administrator deploys an EC2 instance via AWS CloudFormation. A UserData script installs and configures a large application that takes several minutes to finish. The team notices that CloudFormation reports CREATE_COMPLETE for the instance almost immediately, before the application is actually ready, causing dependent resources to fail. What is the correct way to ensure CloudFormation waits until the application setup completes before marking the resource successful?

Accepted Answer

Add a CreationPolicy to the EC2 resource and call cfn-signal from the UserData script after the application setup finishes.

Answer

Add a DependsOn attribute to the EC2 resource referencing the application configuration.

Answer

Increase the stack's timeout value in the CloudFormation console so the create operation waits longer.

Answer

Attach a DeletionPolicy of Retain so the instance is not recreated during provisioning.

Question 16

A SysOps administrator manages a production application using a single CloudFormation stack. The stack contains an RDS DB instance, an EC2 Auto Scaling group, and several security groups. Before applying a template update that modifies the RDS instance class and adds a new parameter, the administrator must understand exactly which resources will be modified, replaced, or deleted — without actually applying any changes to the running environment. What is the MOST appropriate way to obtain this information?

Accepted Answer

Create a CloudFormation change set from the updated template and review the proposed resource actions before executing it

Answer

Run drift detection on the stack to compare the updated template against the currently deployed resources

Answer

Update the stack directly and monitor the stack events tab to see which resources change

Answer

Enable termination protection on the stack and then perform the update to prevent unintended deletions

Question 17

A SysOps administrator manages two separate CloudFormation stacks. A networking stack creates a VPC and subnets and exposes their IDs using the Export field in its Outputs section. An application stack references these values with Fn::ImportValue. When the administrator attempts to delete the networking stack, the deletion fails. What is the cause, and how should the administrator resolve it?

Accepted Answer

The networking stack cannot be deleted while another stack imports its exported values; the application stack must be deleted or updated to remove the imports first.

Answer

The exported values exceeded the maximum size limit; the administrator must split the exports across multiple stacks before deletion.

Answer

Drift was detected on the networking stack; the administrator must run drift detection and remediate before the stack can be deleted.

Answer

The stack has a stack policy that denies deletion; the administrator must update the stack policy to allow the Delete action.

Question 18

A SysOps administrator manages a CloudFormation stack that provisions an application tier and an RDS DB instance holding production data. During a planned decommissioning of the application, the team will delete the stack, but they must ensure the RDS DB instance and its data are NOT destroyed when the stack is deleted. What is the MOST appropriate way to guarantee the database survives stack deletion?

Accepted Answer

Set the DeletionPolicy attribute to Retain on the RDS resource in the template and update the stack before deletion

Answer

Enable termination protection on the CloudFormation stack

Answer

Add the RDS resource to a stack policy that denies the Delete action

Answer

Enable drift detection on the stack so CloudFormation preserves modified resources

Question 19

A SysOps administrator manages production infrastructure using an AWS CloudFormation stack. During an incident, another engineer manually modified a security group's inbound rules directly in the EC2 console to restore service quickly. The administrator now needs to identify every resource in the stack whose live configuration no longer matches the template, without modifying or replacing any resources. Which approach accomplishes this?

Accepted Answer

Run drift detection on the stack and review the drift status and property differences for each resource.

Answer

Create a change set for the stack and inspect the proposed actions to see which resources differ.

Answer

Update the stack with the original template so CloudFormation reports which resources it changed.

Answer

Enable termination protection on the stack and review the CloudFormation event history for manual edits.

Question 20

A SysOps administrator is building a CloudFormation architecture for a multi-tier application. A parent stack must provision a shared VPC and subnets, and several child stacks (application, database, and cache tiers) must reference the VPC ID and subnet IDs created by the networking layer. The administrator wants the tiers deployed and managed as a single deployable unit, so that updating or deleting the parent stack automatically manages all tiers together. Which approach meets these requirements?

Accepted Answer

Use nested stacks by defining AWS::CloudFormation::Stack resources in the parent template, passing the VPC and subnet IDs to each child stack via Parameters

Answer

Deploy each tier as an independent stack and share the VPC ID and subnet IDs using cross-stack references with Export and Fn::ImportValue

Answer

Deploy each tier as an independent stack and store the VPC ID and subnet IDs in SSM Parameter Store, then resolve them in each template with dynamic references

Answer

Use a StackSet to deploy the networking and application templates to multiple accounts so they share the same VPC resources

Question 21

A SysOps administrator manages a production CloudFormation stack that includes an RDS DB instance and several EC2 instances. During routine stack updates, developers occasionally submit template changes that would inadvertently replace or delete the RDS DB instance, causing data loss. The administrator wants to prevent updates to the RDS resource specifically while still allowing updates to the EC2 resources through the normal update process. What should the administrator implement?

Accepted Answer

Apply a stack policy that denies Update:* actions on the RDS DB instance logical resource ID

Answer

Add a DeletionPolicy of Retain to the RDS DB instance in the template

Answer

Enable termination protection on the CloudFormation stack

Answer

Attach an IAM policy to developers denying cloudformation:UpdateStack

Question 22

A SysOps administrator manages a standardized VPC baseline deployed to 40 accounts across an organization using a CloudFormation StackSet. During a security audit, the administrator discovers that in several member accounts, engineers manually modified security group rules and NACLs that were originally provisioned by the StackSet. The administrator needs to identify which stack instances no longer match their template configuration and then bring them back into compliance with the intended baseline. Which approach accomplishes this with the least manual effort?

Accepted Answer

Run drift detection on the stack set to identify stack instances that have drifted, then perform a stack set operation to re-deploy the template and overwrite the manual changes.

Answer

Delete the stack set entirely and recreate it in all 40 accounts to guarantee that resources match the template.

Answer

Enable AWS Config in each member account and create a custom rule that reverts security group changes automatically.

Answer

Log in to each member account, manually compare the security group rules against the baseline document, and correct any differences by hand.

Question 23

A SysOps administrator manages an AWS Organizations environment with three organizational units (OUs): Dev, Staging, and Production. The security team wants to deploy a standardized IAM configuration and a CloudTrail baseline to every existing and future account in the Production OU. The administrator wants the deployments to happen automatically when new accounts are added to the OU, with minimal ongoing manual effort. Which approach meets these requirements?

Accepted Answer

Create a CloudFormation StackSet with service-managed permissions and enable automatic deployment targeting the Production OU.

Answer

Create a CloudFormation StackSet with self-managed permissions and manually add each account's stack instance as new accounts join.

Answer

Use a single CloudFormation stack in the management account and reference each member account with cross-account IAM roles.

Answer

Write an EventBridge rule that triggers a Lambda function to run a CreateStack API call in each new account of the Production OU.

Question 24

A SysOps administrator manages a CloudFront distribution in front of an Application Load Balancer serving a product catalog application. The application returns different content based on a 'category' query string parameter, but users report they consistently see the same product list regardless of the category they select. CloudWatch shows a high cache hit ratio at CloudFront. What is the MOST likely cause and the correct remediation?

Accepted Answer

The cache behavior's cache policy is not configured to include the 'category' query string in the cache key; update the cache policy to forward and cache based on the required query strings.

Answer

The origin's health check is failing; configure an origin failover group so CloudFront routes to a healthy secondary origin.

Answer

The distribution's default TTL is set to 0; increase the minimum and default TTL so CloudFront caches distinct responses per category.

Answer

The ALB is not sticky; enable session stickiness on the target group so each category request reaches the correct backend instance.

Question 25

A media company serves static images through a CloudFront distribution backed by an S3 origin. Monitoring shows a low cache hit ratio and higher-than-expected origin request volume, driving up S3 GET costs. Investigating the origin responses, the SysOps administrator finds that S3 returns objects with a Cache-Control: max-age=60 header, and the distribution's cache behavior is configured to use origin cache headers with a Minimum TTL of 0, Maximum TTL of 60, and Default TTL of 0. The images rarely change. What is the MOST effective change to increase the cache hit ratio?

Accepted Answer

Increase the Minimum TTL and Maximum TTL on the cache behavior (and adjust the S3 Cache-Control max-age) so objects remain cached longer at edge locations.

Answer

Enable query string forwarding on the cache behavior so that CloudFront caches each variation separately.

Answer

Change the origin from S3 to a custom origin using an Application Load Balancer to reduce origin request latency.

Answer

Create an invalidation for /* to force CloudFront to refresh and cache the objects.